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METHOD AND COMPUTER PROGRAM FOR 
CONTROLLING ACCESS RIGHTS TO AN APPLICATION 

[0001] This application claims priority from PCT Application No. 
PCT/EP2004/009945 filed on September 7, 2004, which claims priority to 
German Application No. 103 45 745.3 filed on October 1, 2003, the entire 
disclosure of which is incorporated herein by reference. 

BACKGROUND AND SUMMARY OF THE INVENTION 

[0002] The invention relates to a method and apparatus for controlling access 
rights of users for permitting a plurality of operator control units to access, at 
least one software application which is preferably provided in a vehicle. 

[0003] German Patent Document DE 198 53 665 discloses a vehicle 
communications system and method for exchanging data in a vehicle. The 
vehicle communications system comprises a central system controller which can 
selectively grant access rights to particular applications to individual operator 
control units of the system. This central system controller is implemented in a 
central processing unit or other arithmetic unit of the vehicle communications 
system. In this context the ranking, which is assigned to an operator control 
unit, can be defined either uniformly for all applications or individually for each 
application. In addition, the central system controller can allocate output 
devices to operator control units. The central system controller has a central 
priority management system. One aspect of this is the allocation of access rights 
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for operator control units to a data bus and/or to individual applications. When a 
plurality of actions which have priorities attached to them coincide, the central 
priority management system resolves possible conflicts in favor of one of the 
actions. These competing actions may, for example, involve two operator control 
units with specific priorities requesting an application with a specific priority on 
the same physical device which does not have a multi-console capability. The 
time ranking of the action can also be a suitable decision criterion for the 
solution of such a conflict. 

[0004] One disadvantage of this system is that the access rights are defined 
essentially only for individual operator control units on a data bus and/or with 
respect to individual applications, but they are not placed in a concrete context 
with respect to a man/machine interface; that is, ultimately for individual users 
or operator control units. When placing the access rights or access principles in 
a concrete context it is necessary to consider that not all applications are equally 
suitable for all known access principles. 

[0005] One object of the present invention, therefore, is to provide a method 
and apparatus (including an encoded data carrier) for establishing an access 
principle for applications, as well a communications system for carrying out the 
method, which method takes into account only the particular suitability of 
individual applications for specific access principles. 
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[0006] This and other objects and advantages are achieved by the method 
according to the invention, which provides an application specific access principle 
for allowing access to users, via at least two operator control units, to the same 
application, preferably situated in a vehicle. 

[0007] One example of an access principle in the sense of the invention is the 
"last wins" access principle, according to which that user which accesses an 
application last also controls this application and determines its behavior. In this 
context, the respective content on the- two operator control units may be 
different. Another example of such an access principle is "in parallel in terms of 
switching", which provides that the same content is inevitably displayed on all 
operator control units, irrespective of whether different access operations are 
made to the same application at different operator control units. Furthermore, 
according to a "first wins" access principle, that user which first accesses an 
application also controls this application and determines its behavior. The "first 
wins" access principle preferably provides for a visual and/or audible warning 
message to be issued by the second operator control unit if the application could 
be disrupted, or is disrupted, from the first operator control unit. Alternatively 
or additionally the "first wins" access principle can also be implemented in such 
a way that the access operation to the second operator control unit for the 
application is blocked until the warning message which is issued by means of the 
second operator control unit is acknowledged. 
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[0008] An application in the sense of the invention comprises at least one 
function which permits services to be provided to the user. Typical examples of 
applications are "audio", provided by an audio or hifi system, "video", provided by 
a video recorder, "navigation", provided by a navigation system or 
"communication", provided by a communications device, such as a personal 
computer, preferably with an Internet connection. One function is carried out by 
one of these resources units. 

[0009] One advantage of the use of application-specific access principles is 
that it takes into account the fact that not every application is suitable for every 
conceivable or available access principles. That is, there are often technical 
restrictions which make an application appear suitable only for a specific access 
principle. 

[0010] The "last wins" access principle, for example, is advantageously 
provided for the "audio" and "video" applications, while the "parallel in terms of 
switching" principle is advantageously provided for the navigation system 
application. 

[0011] In the case of specific applications for which the "parallel in terms of 
switching" access principle is activated it is possible to provide a specific case of 
this principle, that is to say the "superuser" access principle for this application. 

[0012] Furthermore, it is advantageous to output a visual and/or audible 
warning by means of an operator control unit if the sequence of an application on 
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another operator control unit could be disrupted, or is disrupted, by the access 
operation from the operator control unit to the application. 

[0013] The abovementioned object is also achieved by a computer program and 
a communications system for carrying out the claimed method, and by a data 
carrier with the computer program. The advantages of these solutions 
correspond to the advantages specified above with respect to the claimed method. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0014] An embodiment of the present invention is described in greater detail 
on the basis of the drawings, in which: 

[0015] The single figure is a schematic diagram which shows the configuration 
of the claimed communications system in a vehicle. 

DETAILED DESCRIPTION OF THE DRAWINGS 

[0016] Referring to the figure, a vehicle 200 has wheels 230 and a 
communications system 100 according to the invention. The communications 
system comprises a computing unit 110 for controlling applications and a 
plurality of operator control units 120-1. ..-3 for providing the applications for 
their users at various locations within the vehicle. The driver's seat 210-1 and 
the front seat passenger's seat 210-2 are jointly allocated the central operator 
control unit 120-1 in the cockpit of the vehicle 200, while the places on the rear 
bench seat 220 within the vehicle 200 are allocated the operator control units 
120-2 and 120-3 at the rear of the vehicle. 
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[0017] The inventive allocation of individual access principles to individual 
applications is basically carried out automatically or is permanently predefined. 
It is preferably configured in such a way that it occurs basically only if a resource 
conflict (that is, a conflict between users when accessing the same application 
from different operator control units 120) cannot be regulated, for example, by 
verbal agreement. A number of situations in which such a solution negotiated 
between people is not possible are described below: 

A resource which is already being used by an application called from 
the rear of the vehicle is requested in the cockpit of a vehicle 200, (that 
is, in particular from the driver's or front seat passenger's seat) by 
means of an application. Example: the "navigation" application is 
being used to simultaneously access the same resource, the disk 
player, both from the cockpit and from the rear of the vehicle. The 
passenger at the rear of the vehicle cannot release the resource 
because, for example, he has got out of the vehicle, has dirty fingers or 
does not know how he should perform the release. In this case, 
nevertheless it must be possible for the user in the cockpit to transfer 
the resource. 

A passenger at the rear of the vehicle wishes to see a video but does 
not know how to set it. 
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A young child is sitting at the rear of the vehicle. The young child 
should be prevented from alarming the driver by meddling with the 
audio sources, for example with a volume controller, thus bringing 
about a dangerous situation. 

A young person is sitting at the rear of the vehicle. The young person 
should be prevented from accessing expensive sources and/or sources 
which are not suitable for young people. 

A boss is sitting at the rear of the vehicle and does not wish a person 
in the cockpit (in particular, the driver) to be able to read his e-mails 
or telephone lists. 

A passenger at the rear of the vehicle has received interesting 
information, for example a destination, via a specific application in the 
form of an information service, and would like to transfer this 
information to the driver as a data record. 

While the driver is using a routing function of the navigation system, 
the passenger at the rear of the vehicle would like to be able to view 
points of interest POIs or be able to freely select details from a map 
using the same navigation system. 
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The driver supports the rear seat passenger by executing working 
steps or functions for the rear seat passenger from the operator control 
unit in the cockpit in order to permit the passenger to use a specific 
application. To do this the driver also enters the rear seat passenger's 
secret code. 

The driver supports the rear seat passenger in a way which is 
analogous to the previous scenario, but this time without having to 
input the secret code of the rear seat passenger because the rear seat 
passenger does not wish to disclose this code to the driver. 

[0018] Solutions for handling the above conflict scenarios will now be 
presented below by way of example. These conflict cases occur primarily 
between the two rear operator control units. Conflicts between the operator 
control unit in the cockpit and the operator control units at the rear generally 
occur only when the navigation system and the transmission unit of the mobile 
telephone are accessed. 

Entertainment 

[0019] Entertainment comprises the "audio" and "video" applications. 
According to the invention, these two applications are allocated the "last wins" 
access principle. This ensures that that user who last brought about an action, 
for example the changeover of a CD, controls the system. With this access 
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principle there is no "owner" of the application in the sense that that user alone 
determines who can access the application or how the application can be 
operated at one time. If a passenger at the rear uses one of the entertainment 
applications by means of a headset, a warning appears regarding another user 
who would like to access this application. If this warning is acknowledged by the 
passenger at the rear, the passenger at the rear thus enables the other user to 
access the application. This warning is then repeated if the other, requesting 
user in the meantime switches over to another entertainment application, in 
particular another audio source. 

[0020] A resource which is commonly shared by applications which are called 
from the rear of a vehicle is the sound system in a single cab vehicle. Audio 
sources (that is, data sources in the form of CDs etc.) for the sound system are 
accessible only from particular operator locations in the vehicle. It is not 
possible, for example, to access a CD changer in the rear of the vehicle from the 
cockpit, or to access a cassette drive at the front of the vehicle from the rear. If 
the sound system is currently being used by a rear seat passenger, utilizing an 
audio source in the rear of the vehicle, and at the same time the driver of the 
vehicle attempts also to access the sound system and for this purpose activates a 
different source, for example at the front of the vehicle, for the sound system, a 
warning appears for the rear seat passenger. The rear seat passenger releases 
the sound system for the driver only if he acknowledges this warning. The sound 
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system can then access the audio source which is desired by the driver and is 
located at the front of the vehicle, for example. 

Communications 

[0021] The "communications" application comprises in particular a mobile 
telephone or a communications device with Internet connection (a PC with 
Internet connection, for example). In these cases, the communications channel 
resource (the connections of these applications to the outside world) is the critical 
item. Because it is necessary to prevent a subscriber from erroneously 
interrupting the connection of another subscriber, according to the invention a 
current user of the communications channel (whether via the mobile telephone 
or a communications device with Internet connection, PC) receives a warning 
message if another user attempts also to access this communications channel. 
The current user is then requested to explicitly enable his application to be 
interrupted by the other user by means of a confirmation; if he does not, the 
current user can continue to access the communications channel with his 
application and the other user is refused permission to use the communications 
channel. 

[0022] For the configuration of the "communications" application there are in 
particular three various alternatives: 
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1. There is only one transmission unit of a mobile telephone, specifically in 
the cockpit of the vehicle. In this case, the conflicts between all three 
operator control units (that is, between the operator control unit in the 
cockpit and the two operator control units at the rear of the vehicle) are 
regulated. 

2. There is a transmission unit of a mobile telephone in the cockpit and one 
at the rear of the vehicle. In this case, conflicts occur only between the two 
operator control units at the rear of the vehicle since the transmission unit 
in the cockpit is available exclusively to the driver. 

3. There is a transmission unit in the cockpit and one at the rear. The 
transmission unit in the cockpit can according to the invention also be 
operated from the rear. In this case, the conflicts between all three 
operator control units are regulated. 

[0023] When there is an incoming call, a warning message is also displayed on 
the rear operator control unit. 

Navigation 

[0024] With the "navigation" application it is not possible for reasons of 
resources to permit different access operations to the application in the cockpit 
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and at the rear of the vehicle. Thus, for example, it is not possible to display 
different maps in the cockpit and at the rear of the vehicle or to display one map 
in the cockpit and at the same time enter a destination from the rear of the 
vehicle. 

[0025] For this reason, according to the invention the "navigation" application 
is allocated the "parallel in terms of switching" access principle. This means that 
as long as a navigation mask is called up both on the operator control unit in the 
cockpit and on the operator control units at the rear, the same content is 
displayed on both operator control units. This occurs irrespective of whether a 
specific soft key or a specific hard key is pressed on one of the operator control 
units in the cockpit or at the rear of the vehicle. The same applies to 
simultaneous operator control of the "navigation" application by means of the 
two operator control units at the rear of the vehicle. 

[0026] If the "navigation" application is activated on one of the operator 

control units and a MAP key, with which a map of the navigation system is 

called, is pressed on a different operator control unit by a different subscriber, a 

warning appears on the operator control unit at which the navigation system is 

active. The requested map will not be released on the other operator control unit 

until this warning is acknowledged by the original user. The same applies 

conversely if the map is active at the original user and a NAV key is pressed on 

the other operator control unit in order to call the navigations system or to 

transfer the navigation system into a basic mode. 
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[0027] In specific cases, it is possible within the scope of the "parallel in terms 
of switching" access principle which is to be recommended in particular for the 
"navigation" application, to use the specific "superuser" access principle. The 
"superuser" access principle is distinguished by operator control which is parallel 
in terms of switching and which can be switched on and off by an authorized 
user. The latter is recommended for example if the operator control of an 
operator control unit 120 at the rear is to be performed from the cockpit in order 
to support the user of this operator control unit at the rear in his use of such 
unit. For this purpose there is provision that within a basic video mask on the 
operator control unit in the cockpit, the system switches over between the left- 
hand or right-hand operator control unit at the rear. 

[0028] The operator control is then carried out by means of the hard keys 
and/or soft keys of the operator control unit 120-1 in the cockpit. 

[0029] During the "superuser" access principle, operator control is possible 

both from the cockpit and from the places at the rear of the vehicle. On the 

operator control units 120-2, 120-3 at the rear of the vehicle a symbol then 

indicates that the same image is displayed on the operator control unit 120-1 in 

the cockpit. This option can preferably be switched off by means of a 

configuration menu of the operator control unit at the rear of the vehicle. For 

safety reasons it is recommended that in video applications in the superuser 

mode, only a still image is displayed on the operator control unit 120-1 in the 

cockpit if the vehicle's velocity exceeds a predefined threshold value. 
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[0030] Two alternative ways of exiting the superuser mode are presented: 

[0031] On the one hand, pressing on an eject key and on the other hand 
simultaneously pressing two numerical keys. From the point of view of the 
man/machine interface the first alternative is preferred. 

Child safety 

[0032] According to the invention, access rights for children are restricted to 
specific applications at the places 220 in the vehicle at which children usually sit. 
This restriction can basically be implemented in different stages. For example, 
children can be refused any access rights to applications or their access rights to 
specific communication resources can be restricted. 

[0033] The foregoing disclosure has been set forth merely to illustrate the 

invention and is not intended to be limiting. Since modifications of the disclosed 
embodiments incorporating the spirit and substance of the invention may occur 
to persons skilled in the art, the invention should be construed to include 
everything within the scope of the appended claims and equivalents thereof. 
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